@intx/db 0.2.2 → 0.3.0

package/migrations/meta/_journal.json

@@ -260,6 +260,335 @@
       "when": 1783998502613,
       "tag": "0036_sharp_the_executioner",
       "breakpoints": true
+    },
+    {
+      "idx": 37,
+      "version": "7",
+      "when": 1784193583232,
+      "tag": "0037_credential_use_backfill",
+      "breakpoints": true
+    },
+    {
+      "idx": 38,
+      "version": "7",
+      "when": 1784229989017,
+      "tag": "0038_chilly_blacklash",
+      "breakpoints": true
+    },
+    {
+      "idx": 39,
+      "version": "7",
+      "when": 1784262044343,
+      "tag": "0039_quick_carnage",
+      "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "7",
+      "when": 1784290369159,
+      "tag": "0040_reshape_approval_origin",
+      "breakpoints": true
+    },
+    {
+      "idx": 41,
+      "version": "7",
+      "when": 1784291992954,
+      "tag": "0041_make_approval_timeout_at_nullable",
+      "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "7",
+      "when": 1784385053475,
+      "tag": "0042_youthful_mantis",
+      "breakpoints": true
+    },
+    {
+      "idx": 43,
+      "version": "7",
+      "when": 1784574028729,
+      "tag": "0043_signal_correlation_deployment_fk",
+      "breakpoints": true
+    },
+    {
+      "idx": 44,
+      "version": "7",
+      "when": 1784647908094,
+      "tag": "0044_model_offering_quirks",
+      "breakpoints": true
+    },
+    {
+      "idx": 45,
+      "version": "7",
+      "when": 1784683821134,
+      "tag": "0045_create_workflow_run",
+      "breakpoints": true
+    },
+    {
+      "idx": 46,
+      "version": "7",
+      "when": 1784685004809,
+      "tag": "0046_approval_signal_correlation_run_fk",
+      "breakpoints": true
+    },
+    {
+      "idx": 47,
+      "version": "7",
+      "when": 1784837465838,
+      "tag": "0047_create_workflow_definition",
+      "breakpoints": true
+    },
+    {
+      "idx": 48,
+      "version": "7",
+      "when": 1784843439588,
+      "tag": "0048_workflow_definition_origin_agent_id",
+      "breakpoints": true
+    },
+    {
+      "idx": 49,
+      "version": "7",
+      "when": 1784874344480,
+      "tag": "0049_curly_omega_flight",
+      "breakpoints": true
+    },
+    {
+      "idx": 50,
+      "version": "7",
+      "when": 1784900369564,
+      "tag": "0050_late_crystal",
+      "breakpoints": true
+    },
+    {
+      "idx": 51,
+      "version": "7",
+      "when": 1784904262816,
+      "tag": "0051_funny_madelyne_pryor",
+      "breakpoints": true
+    },
+    {
+      "idx": 52,
+      "version": "7",
+      "when": 1784930942498,
+      "tag": "0052_drop_inference_turn_instance_fk",
+      "breakpoints": true
+    },
+    {
+      "idx": 53,
+      "version": "7",
+      "when": 1784937859340,
+      "tag": "0053_session_mail_session_id_index",
+      "breakpoints": true
+    },
+    {
+      "idx": 54,
+      "version": "7",
+      "when": 1784954863099,
+      "tag": "0054_rekey_instance_grants_to_workflow_run",
+      "breakpoints": true
+    },
+    {
+      "idx": 55,
+      "version": "7",
+      "when": 1785022747684,
+      "tag": "0055_backfill_anchor_workflow_runs",
+      "breakpoints": true
+    },
+    {
+      "idx": 56,
+      "version": "7",
+      "when": 1785077765166,
+      "tag": "0056_repoint_deployment_fks_to_anchor_run",
+      "breakpoints": true
+    },
+    {
+      "idx": 57,
+      "version": "7",
+      "when": 1785081029417,
+      "tag": "0057_drop_workflow_deployment_projection",
+      "breakpoints": true
+    },
+    {
+      "idx": 58,
+      "version": "7",
+      "when": 1785085643398,
+      "tag": "0058_repoint_offering_fk_to_definition",
+      "breakpoints": true
+    },
+    {
+      "idx": 59,
+      "version": "7",
+      "when": 1785087256544,
+      "tag": "0059_repoint_transaction_fk_to_run",
+      "breakpoints": true
+    },
+    {
+      "idx": 60,
+      "version": "7",
+      "when": 1785089581427,
+      "tag": "0060_drop_session_mail_instance_fk",
+      "breakpoints": true
+    },
+    {
+      "idx": 61,
+      "version": "7",
+      "when": 1785089702623,
+      "tag": "0061_drop_session_asset_instance_fk",
+      "breakpoints": true
+    },
+    {
+      "idx": 62,
+      "version": "7",
+      "when": 1785165557463,
+      "tag": "0062_drop_agent_asset_table",
+      "breakpoints": true
+    },
+    {
+      "idx": 63,
+      "version": "7",
+      "when": 1785167954461,
+      "tag": "0063_repoint_agent_role_fk_to_definition",
+      "breakpoints": true
+    },
+    {
+      "idx": 64,
+      "version": "7",
+      "when": 1785169484868,
+      "tag": "0064_repoint_agent_session_fk_to_definition",
+      "breakpoints": true
+    },
+    {
+      "idx": 65,
+      "version": "7",
+      "when": 1785179839765,
+      "tag": "0065_add_workflow_definition_model_requirements",
+      "breakpoints": true
+    },
+    {
+      "idx": 66,
+      "version": "7",
+      "when": 1785280000000,
+      "tag": "0066_rekey_agent_definition_principals_to_workflow",
+      "breakpoints": true
+    },
+    {
+      "idx": 67,
+      "version": "7",
+      "when": 1785400000000,
+      "tag": "0067_add_workflow_definition_kind",
+      "breakpoints": true
+    },
+    {
+      "idx": 68,
+      "version": "7",
+      "when": 1785500000000,
+      "tag": "0068_drop_agent_tables_and_origin_agent_id",
+      "breakpoints": true
+    },
+    {
+      "idx": 69,
+      "version": "7",
+      "when": 1785337102704,
+      "tag": "0069_drop_workflow_definition_kind",
+      "breakpoints": true
+    },
+    {
+      "idx": 70,
+      "version": "7",
+      "when": 1785519721882,
+      "tag": "0070_flashy_proteus",
+      "breakpoints": true
+    },
+    {
+      "idx": 72,
+      "version": "7",
+      "when": 1785788422511,
+      "tag": "0072_add_workflow_definition_credential_bindings",
+      "breakpoints": true
+    },
+    {
+      "idx": 73,
+      "version": "7",
+      "when": 1785791424774,
+      "tag": "0073_grant_target_exactly_one_check",
+      "breakpoints": true
+    },
+    {
+      "idx": 74,
+      "version": "7",
+      "when": 1785884353793,
+      "tag": "0074_add_provider_api_base_url",
+      "breakpoints": true
+    },
+    {
+      "idx": 75,
+      "version": "7",
+      "when": 1786055554289,
+      "tag": "0075_workflow_run_launch_spec",
+      "breakpoints": true
+    },
+    {
+      "idx": 76,
+      "version": "7",
+      "when": 1786055582673,
+      "tag": "0076_sidecar_allocation",
+      "breakpoints": true
+    },
+    {
+      "idx": 77,
+      "version": "7",
+      "when": 1786055601046,
+      "tag": "0077_workflow_run_dispatch",
+      "breakpoints": true
+    },
+    {
+      "idx": 78,
+      "version": "7",
+      "when": 1786055642946,
+      "tag": "0078_workflow_run_dispatch_kind",
+      "breakpoints": true
+    },
+    {
+      "idx": 79,
+      "version": "7",
+      "when": 1786480852752,
+      "tag": "0079_rename_workflow_run_deployment_id_to_anchor_run_id",
+      "breakpoints": true
+    },
+    {
+      "idx": 80,
+      "version": "7",
+      "when": 1786481000000,
+      "tag": "0080_rename_correlation_approval_deployment_id_to_anchor_run_id",
+      "breakpoints": true
+    },
+    {
+      "idx": 81,
+      "version": "7",
+      "when": 1786665226312,
+      "tag": "0081_workflow_definition_content_hash_and_approved_wire_hash",
+      "breakpoints": true
+    },
+    {
+      "idx": 82,
+      "version": "7",
+      "when": 1787066175571,
+      "tag": "0082_blue_black_queen",
+      "breakpoints": true
+    },
+    {
+      "idx": 83,
+      "version": "7",
+      "when": 1787096121244,
+      "tag": "0083_replace_launch_spec_snapshot_with_frozen_bundle",
+      "breakpoints": true
+    },
+    {
+      "idx": 84,
+      "version": "7",
+      "when": 1787169492000,
+      "tag": "0084_delete_orphaned_credential_grants",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@intx/db",
-  "version": "0.2.2",
+  "description": "Client, schema, migrations, and row parsers for the hub's PostgreSQL database",
+  "version": "0.3.0",
   "license": "LGPL-2.1-only",
   "type": "module",
   "exports": {
@@ -16,8 +17,10 @@
     }
   },
   "dependencies": {
-    "@intx/log": "0.2.2",
-    "@intx/types": "0.2.2",
+    "@intx/authz": "0.3.0",
+    "@intx/crypto": "0.3.0",
+    "@intx/log": "0.3.0",
+    "@intx/types": "0.3.0",
     "arktype": "^2.1.29",
     "drizzle-orm": "^0.45.1",
     "postgres": "^3.4.8"

package/dist/schema/agent-assets.d.ts

@@ -1,109 +0,0 @@
-export declare const agentAsset: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "agent_asset";
-    schema: undefined;
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "agent_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agent_id";
-            tableName: "agent_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        assetId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "asset_id";
-            tableName: "agent_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        ref: import("drizzle-orm/pg-core").PgColumn<{
-            name: "ref";
-            tableName: "agent_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        accessMode: import("drizzle-orm/pg-core").PgColumn<{
-            name: "access_mode";
-            tableName: "agent_asset";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "created_at";
-            tableName: "agent_asset";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: "pg";
-}>;

package/dist/schema/agent-assets.js

@@ -1,15 +0,0 @@
-import { pgTable, text, timestamp, unique } from "drizzle-orm/pg-core";
-import { agent } from "./agents.js";
-import { asset } from "./assets.js";
-export const agentAsset = pgTable("agent_asset", {
-    id: text("id").primaryKey(),
-    agentId: text("agent_id")
-        .notNull()
-        .references(() => agent.id, { onDelete: "cascade" }),
-    assetId: text("asset_id")
-        .notNull()
-        .references(() => asset.id, { onDelete: "cascade" }),
-    ref: text("ref").notNull(),
-    accessMode: text("access_mode").notNull().default("read-only"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-}, (t) => [unique("agent_asset_agent_asset").on(t.agentId, t.assetId)]);

package/dist/schema/agents.js

@@ -1,57 +0,0 @@
-import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { principal } from "./principals.js";
-import { tenant } from "./tenants.js";
-export const agent = pgTable("agent", {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id")
-        .notNull()
-        .references(() => tenant.id, { onDelete: "cascade" }),
-    // Tracks the definition author's principal for resolving source:"creator"
-    // grant requirements at launch. See AUTH.md § Grant Requirements on Definitions.
-    creatorPrincipalId: text("creator_principal_id")
-        .notNull()
-        .references(() => principal.id),
-    name: text("name").notNull(),
-    description: text("description"),
-    systemPrompt: text("system_prompt"),
-    contextConfig: jsonb("context_config"),
-    initialState: jsonb("initial_state"),
-    modelConfig: jsonb("model_config"),
-    capabilities: jsonb("capabilities"),
-    credentialRequirements: jsonb("credential_requirements"),
-    // Model needs declared by canonical name with per-model provider
-    // preferences, validated as ModelRequirements at parse time. The control
-    // plane resolves these against the tenant catalog at launch to build the
-    // ordered inference sources; credentialRequirements covers only
-    // tool/integration credentials, not inference.
-    modelRequirements: jsonb("model_requirements"),
-    // Pinned tool packages, validated as ToolPackagePin[] at parse time.
-    // Empty array (the default) means the agent has no NPM-distributed
-    // tool packages wired to it; the loader receives an empty closure
-    // and produces no tool factories for this agent.
-    toolPackages: jsonb("tool_packages").notNull().default([]),
-    // Grant requirements manifest — resolved at launch into materialized grants
-    // on the instance principal. See AUTH.md § Grant Requirements on Definitions.
-    grantRequirements: jsonb("grant_requirements"),
-    currentVersion: text("current_version").notNull().default("1"),
-    status: text("status", {
-        enum: ["deployed", "stopped"],
-    })
-        .notNull()
-        .default("deployed"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-});
-export const agentVersion = pgTable("agent_version", {
-    id: text("id").primaryKey(),
-    agentId: text("agent_id")
-        .notNull()
-        .references(() => agent.id, { onDelete: "cascade" }),
-    version: text("version").notNull(),
-    status: text("status", {
-        enum: ["active", "inactive", "failed"],
-    })
-        .notNull()
-        .default("active"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-});

package/dist/schema/instances.js

@@ -1,39 +0,0 @@
-import { jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-import { agent, agentVersion } from "./agents.js";
-import { agentSession } from "./sessions.js";
-import { principal } from "./principals.js";
-import { sidecar } from "./sidecar.js";
-import { tenant } from "./tenants.js";
-export const agentInstance = pgTable("agent_instance", {
-    id: text("id").primaryKey(),
-    agentId: text("agent_id")
-        .notNull()
-        .references(() => agent.id, { onDelete: "cascade" }),
-    tenantId: text("tenant_id")
-        .notNull()
-        .references(() => tenant.id, { onDelete: "cascade" }),
-    principalId: text("principal_id")
-        .notNull()
-        .references(() => principal.id),
-    address: text("address").notNull().unique(),
-    versionId: text("version_id").references(() => agentVersion.id),
-    sessionId: text("session_id").references(() => agentSession.id),
-    status: text("status", {
-        enum: ["deployed", "running", "updating", "error", "stopped"],
-    })
-        .notNull()
-        .default("deployed"),
-    sidecarId: text("sidecar_id").references(() => sidecar.id, {
-        onDelete: "set null",
-    }),
-    publicKey: text("public_key"),
-    kernelId: text("kernel_id"),
-    // The invoker's launch-time per-model provider preferences, validated as
-    // InvokerModelPreferences at parse time. Persisted here so re-resolving an
-    // instance's sources (on credential rotation or sidecar reconnect) reuses
-    // the invoker's reorder/restrict, not just the definition's preferences.
-    modelPreferences: jsonb("model_preferences"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-    endedAt: timestamp("ended_at"),
-});

package/dist/schema/workflow-deployments.js

@@ -1,37 +0,0 @@
-import { index, pgTable, text, timestamp, uniqueIndex, } from "drizzle-orm/pg-core";
-import { asset } from "./assets.js";
-import { tenant } from "./tenants.js";
-export const workflowDeployment = pgTable("workflow_deployment", {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id")
-        .notNull()
-        .references(() => tenant.id, { onDelete: "cascade" }),
-    definitionAssetId: text("definition_asset_id")
-        .notNull()
-        .references(() => asset.id, { onDelete: "cascade" }),
-    // The deployment's routable address (`ins_<id>@<domain>`), stored rather
-    // than re-derived at read time so the reconnect ownership challenge can
-    // look up the deployment's public key by address, symmetrically with the
-    // `agent_instance` path. Unique so a double-insert fails loud.
-    //
-    // Added NOT NULL with no default and no backfill. Like the repo's other
-    // such adds (e.g. `credential.provider_id`), the migration relies on the
-    // table being empty when it runs: this table and the `address` column
-    // land one migration apart, both unreleased, so no populated row predates
-    // the column and none needs a backfilled address.
-    address: text("address").notNull(),
-    // The Ed25519 public key the sidecar minted for this deployment address,
-    // persisted at deploy-ack. Nullable by design: the row is written at
-    // deploy-start and the key arrives at ack, so a not-yet-acked deployment
-    // reads `null` and its reconnect challenge fails closed -- the address
-    // stays unrouted rather than routing without ownership proof.
-    publicKey: text("public_key"),
-    status: text("status")
-        .$type()
-        .notNull()
-        .default("deployed"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-}, (t) => [
-    index("workflow_deployment_tenant_idx").on(t.tenantId, t.createdAt),
-    uniqueIndex("workflow_deployment_address_idx").on(t.address),
-]);